Skip to main content

Belay

Detect · Block · Notify — a defense and monitoring layer for AI coding agents.

Belay (formerly AIDefender) is a local-first security layer that sits at the tool-call boundary of AI coding agents (Claude Code, Codex, Cline, Roo, Cursor, Gemini CLI, Goose, OpenClaw, Hermes, Antigravity, opencode, and more). It auto-detects the agents you already run, blocks dangerous actions outright, escalates ambiguous-but-risky ones to you for a one-tap Allow / Deny, and notifies you when something happens.

The decision engine is deterministic, no-LLM, sub-100 ms, and fail-closed — a timeout or an internal error becomes a deny, never a silent allow. Verdict priority is Deny > Ask > Allow, and a Deny can never be downgraded by the allowlist. Belay runs as your user (never root) and does not phone home by default.

Belay is a single static Rust binary (belay) with all subcommands, plus an optional Tauri desktop app. There is no runtime dependency on Python.

What it stops​

  • Secret exfiltration — .env files, API keys, SSH keys
  • Destructive commands — rm -rf /, curl … | sh
  • Reverse shells and command-and-control egress
  • Supply-chain, persistence, privilege-escalation, and recon patterns

What's new​

  • Explain & Advise — every verdict now carries a plain-English explanation of why a call is risky and what to do, curated per rule. An optional AI explainer (off by default, BYOK) can add a natural-language narrative — advisory only, it never changes a decision, and secrets are redacted before any send.
  • Two-way approvals over chat — send an ask prompt to Telegram, Discord, WhatsApp, Matrix, Mattermost, or Slack and take the Allow / Deny reply back. ntfy, Microsoft Teams, WeCom, generic webhook, and terminal are notify-only. Approvers enroll with a one-time pairing code; prompts auto-expire (stale = auto-denied).
  • Egress destination enrichment — outbound destinations can be annotated with reverse DNS, ASN, owner, and country (display-only, off by default; it never gates a decision).
  • KEV / EPSS in vuln reports — the bundled vulnerability DB now surfaces CISA KEV (known-exploited) badges and EPSS exploit-probability percentages.
  • Setup wizard — belay setup (also auto-run by the installer) detects agents, protects the ones you choose, and optionally configures the firewall, AI explainer, messaging channels, a vuln-scan schedule, and the boot-start service.

Install​

One command downloads the verified static binary and runs the setup wizard:

curl -fsSL https://dl.belay.secblok.io/install.sh | bash

Binary only, no wizard: append -s -- --skip-setup.

Start here​

  • Quickstart — install, protect an agent, and watch it work in minutes.
  • How it works — the tool-call boundary model and the deterministic engine.
  • CLI overview — the single belay binary and its subcommands.
  • Community & Licensing — what's free (open source, AGPL-3.0) and what's Enterprise.
note

belay serve runs a local API + SSE backend on 127.0.0.1:8787 — it is not a web dashboard. The desktop app is the user interface.